{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b3dea19b-9574-521a-9749-a82948e35f9f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-core", "purl": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12", "version": "5.3.31-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:5da3b9e2-7c4a-5b5f-b725-78539aabb4c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:2b862c64-15f6-5872-82dd-7cc8c57f49ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:d2c172d6-02ce-5ab4-8933-882c8838e502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:1fb303cc-e037-57b3-9518-a6178db53572", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:73504609-96bf-55ed-9df8-29ffebd8899d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:4ef94945-861a-59ef-8dc0-ac09d772a4b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:e09bd388-4df3-51a7-a019-7882bc731284", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:8cbf5996-6451-55c8-aa03-b3c96cd7a484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:457a534a-f346-5aa7-9c05-1771c5025fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:529ae927-d6be-5c20-bcad-116ecdd1f5bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:28bed603-83da-5964-8173-51aa6e47ee51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:a9bb512a-f77a-5c05-a38a-0d3d155babb6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-core 5.3.31-tuxcare.12." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:3506511a-dd37-5030-8751-4afe35b4dbbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:85f29005-178a-54c1-8eb6-3c6b5afc1bbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:efd64a0e-8389-53ad-8ada-39b59aa7df55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:aa0e43b9-3ba6-54f1-8519-a4420c5ba795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:5325fbe3-2b82-5b47-9f29-c09d7274c9ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:b1acb5df-6d2e-56b6-9232-707c349b42a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:ada8e467-6e66-5335-96d2-c6adf9ff0af8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:b4eb10b4-755c-5f07-9e18-1dddf2f7d5f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:9ff1b017-140c-5262-8100-96fb2b5d97c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:f64439d6-7f1d-5da6-bb4f-7276936703be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:f123adc4-2fa3-5d2d-8626-2126be6be356", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.12 of org.springframework:spring-core. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:1d2da2cf-b5a6-5925-8284-44dc01a1b284", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:fd451c76-c6c7-5089-9201-7158e1e6fa82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:0f62b448-97b4-5b10-b903-2ac73d9d7f2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:681ff25d-9172-50e4-9278-5e78e5c0fa2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:02a31240-303a-59b6-a637-2dcfebddd0df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:5ff321c2-42a9-5453-b103-cd94d77db847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:26b45972-d640-5e17-a304-3146471847ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:ef94d16b-d494-5adb-9dfa-9718497b884d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:b3bf9513-62a5-594c-ae79-097dacbb287a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:9d53cfb8-4edd-5e84-acbe-ce85b7e1e8dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:d27a0a41-b101-5472-9a07-cee5ebbf2a52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:603b985d-3c26-518a-be1c-155d90b34edf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:497f4a11-c1ff-5c52-98cd-0e5ead1a81a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:5bc9ff7a-31b2-51cd-8831-50b09a7259c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:7134b7d1-5670-550c-8303-17eb7b039c54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-core." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:c187507b-bf77-5124-87ef-a0240f158623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:8e986248-01dc-57f6-b1ac-4b926452fd4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.15." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:41380a62-079e-52d2-98c1-0ce43d8755a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:14f70111-74a5-5307-a46f-195855955c7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:5654cc41-caf2-5924-853f-66c25a5197a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:d1a195eb-8daf-58ac-b25a-34623e8e0f0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:4dc7edf5-dd7a-5e10-afee-73ccd0059a2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:fffacc3b-7a75-5543-b076-fd7fef6c6e3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:d7afa251-5d91-5017-8d95-3e347b461923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:17320392-1bd6-5d98-b3bf-48c9e5000757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:e5525c47-3e4f-5c48-9582-be9724e03ff8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:fb1910c4-e46b-5825-9814-f5fb2be1ee93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.13." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ], "bom-ref": "urn:uuid:de5c7efa-3de9-5bda-88bf-fd7d2083c908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.12 of org.springframework:spring-core, and is fixed in 5.3.31-tuxcare.14." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-core@5.3.31-tuxcare.12" } ] }